diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 50a15b166..1ca8c9394 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,9 @@
+2002-09-29  Christopher Faylor  <cgf@redhat.com>
+
+	* security.cc (allow_ntsec): Default to zero.
+	* environ.cc (environ_init): Set allow_ntsec to TRUE by default,
+	assuming OS allows it.
+
 2002-09-29  Christopher Faylor  <cgf@redhat.com>
 
 	* environ.cc (environ_init): Avoid a compiler warning.
diff --git a/winsup/cygwin/environ.cc b/winsup/cygwin/environ.cc
index 529049338..2b109e226 100644
--- a/winsup/cygwin/environ.cc
+++ b/winsup/cygwin/environ.cc
@@ -675,11 +675,9 @@ environ_init (char **envp, int envc)
   if (myself->progname[0])
     got_something_from_registry = regopt (myself->progname) || got_something_from_registry;
 
-#ifdef NTSEC_ON_BY_DEFAULT
   /* Set ntsec explicit as default, if NT is running */
   if (wincap.has_security ())
     allow_ntsec = TRUE;
-#endif
 
   if (!envp)
     envp_passed_in = 0;
diff --git a/winsup/cygwin/security.cc b/winsup/cygwin/security.cc
index e9e8877a1..49eb82916 100644
--- a/winsup/cygwin/security.cc
+++ b/winsup/cygwin/security.cc
@@ -41,7 +41,7 @@ details. */
 #include "lm.h"
 
 extern BOOL allow_ntea;
-BOOL allow_ntsec = true;
+BOOL allow_ntsec;
 /* allow_smbntsec is handled exclusively in path.cc (path_conv::check).
    It's defined here because of it's strong relationship to allow_ntsec.
    The default is TRUE to reflect the old behaviour. */